Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About suneq
suneq
Getting noticed
Member since May 31, 2021
Dec 4 2021
Community Record
27
Posts
1
Kudos
0
Solutions
Badges
Dec 2 2021
8:16 AM
Hi, We learned the hard way that L7 firewall rules will be applied for both VPN and Internet traffic. Is there a way to configure so that L7 firewall rules will be applied for Internet traffic only please? Thanks.
... View more
Nov 23 2021
6:56 AM
Hi @Ryan_Miles, the client has their captive portal Ucopia which is working well and therfore, they do not want to change anything. Any solution for that? Thanks.
... View more
Nov 23 2021
6:13 AM
Hi, I am asked to design a Guest Wifi architecture for spokes with some basic requirements: - Guest Wifi user should have access to Internet only - A single Guest Wifi subnet should be used for all 600+ sites However, the splash page should be stored in an internal server which is located in the Data Center / hub. This splash page will not be reachable via Internet. From my understanding, if the splash page is only reachable from AutoVPN tunnel, I guess that the Guest Wifi VLAN / subnet of each spoke should be advertise to the hub => so we cannot use single Guest Wifi subnet but we should have 1 subnet per spoke and things get more complicated. Am I correct? Is there any way to meet the requirement? Thanks for your advice.
... View more
Nov 4 2021
2:53 AM
@Ryan_Miles thanks a lot, your advices are very helpful. For my understanding, if we have to change a setting which is not available for override, we have to unbind the site and we will have an outage because the local networks will revert to the version prior applying the template, am I correct? Thanks.
... View more
Nov 3 2021
6:15 PM
Hi, I would like to deploy the MX67W on around 700+ sites, all sites share the same configuration except the local networks. All local networks belong to the subnet 172.16.0.0/12 and have the same subnet mask /26. From what I learned from the documentation, configuration template seems to be a good solution. Is there any important drawback that I must know before implementing template please? Is there any situation in which a modification of the template or a human error can cause outage or problem? I surely overthink but I'm scared of losing all 700+ sites at the same time. Thanks for your advices.
... View more
Oct 25 2021
9:59 AM
Hi @Bruce Thanks for your explanation. Is there any Meraki documentation in which I can find more details about the IPsec tunnel mechanisms you mentionned please (how it detects the failover, how long... etc.) Thanks.
... View more
Oct 25 2021
9:56 AM
Hi @ww , Thanks for your swift reply. I actually read that topic just before opening this one because that is the only one mentionning Ucopia that I found in our forum. However, it was still not clear to me if Ucopia captive portal is supported for MX appliances and how to deploy it.
... View more
Oct 25 2021
9:20 AM
Hi, Our client wants to deploy the Guest Wifi on their MX67W and they want to keep their existing Ucopia captive portal. I am a bit worried because I don't know much of Wifi and I have not found any document on this topic (Ucopia captive portal). Has someone deployed this please? Could you please advise which document I should read to be able to deploy this solution? Thanks a lot.
... View more
Oct 23 2021
4:56 PM
Hi, My client has all their spokes configured with a basic topology: 1 MX + 2 ISP routers. I recently did a soft failure test by disconnecting the WAN link of the primary ISP router. What I noticed is the converge time of VPN traffic is much faster than Internet traffic. I tested with 3 sites and saw the same behavior: VPN traffic was back after 1-2 minutes but we should always wait for around 4-5 minutes to see our "ping 8.8.8.8" works again. I understood that in case of soft failure, the convergence time can be up to 5 minutes, what I do not understand is why the difference between VPN traffic and Internet traffic. Could you help me to understand what happened please? Thanks.
... View more
Sep 29 2021
3:45 PM
Hi guys, How do you prove to your client that Dynamic Path Selection works please? For example, let's say we have a simple rule saying that Citrix traffic should prefer the WAN 1 path and if the latency is higher than 200ms, switch to WAN 2. What we should do to show that the rule works properly? My client insists for a proof / demo. Thanks.
... View more
Sep 29 2021
3:30 PM
Thanks for your replies. I've noticed recently that I was mistaken from the beginning, my MX67 did not work with the same IP on WAN 1 and WAN 2, the WAN 2 status was failed. I had a Meraki engineer on the phone and he confirmed that we can configure WAN 1 and WAN2 in the same subnet but they cannot share the same IP. Sorry for the wrong information.
... View more
Sep 21 2021
1:12 AM
Hi, I want to deploy around 100+ MX67W on remote sites (1 MX per site). Each site has always 2 Internet routers to which the MX67W will be connected. The WAN 1 and WAN 2 ports will be configured to obtain IP addresses with DHCP from the Internet routers. I tested with a quick lab and noticed that the MX67W worked fine with WAN 1 and WAN2 using the same IP adress 192.168.1.1 (provided by the Internet routers). I have a few basic questions here 😊: 1. how it works (same IP on both uplinks) behind the scene? are WAN 1 and WAN2 ports on different VRF or something like that? Is it documented somewhere? 2. Is there any potential problem if we proceed the deployment like that (all uplinks of 100+ MX 67W will use the same IP 192.168.1.1)? Thanks for your advice.
... View more
Jul 29 2021
5:21 PM
Hi, My client is a multinational company and they have a lot of agencies in Europe. Last year, they built a small DC in Germany and then brought up a hub and spoke network to connect all the German agencies. All MX devices are managed by German team so they created a organization called, let's say "COMPANY-GERMANY". The client is happy so they want to do the same thing in Italy: build a new small DC, bring up a hub to spoke network to connect all Italian agencies and as you may guess create a separate organization "COMPANY-ITALY" managed by Italian team. If everything goes well, they will probably do the same thing for France and UK. I am pretty new to Meraki and don't have any experience of creating multiple organizations, so I have a few questions: 1. Do you often see client with multiple organizations please? (I want to hear more from the field, if you say yes I will be much more comfortable 🙂) 2. Is there any downside of creating a lot of organization ? I'm thinking if one day they want to bring up tunnels between Italian agencies and a German hub, it seems that AutoVPN will not work. Could it be a good reason to use only 1 organization? 3. Is there a way to merge 2 or more organizations? If yes what will be the impact? Any advice will be highly appreciated, thanks for your kind help.
... View more
Labels:
- Labels:
-
Other
Jul 18 2021
12:43 PM
Hi @GIdenJoe , Thanks for your explanation. I will ask the client to add a back-to-back link and iBGP between 2 Cores. I wanted to be sure that I undertood the logic before asking the client to change their design. Thanks again.
... View more
Jul 18 2021
6:24 AM
Hi @ww , thanks for your reply, our client does not have any link and therefore no iBGP between Core 1 and Core 2. It's a bit strange but it's their design.
... View more
Jul 17 2021
6:16 PM
Hi, I have a simple topology, as show in the diagram below : 1 spoke with 2 hubs : priority of hub 1 is higher than hub 2 eBGP between hub 1 and Core 1 eBGP between hub 2 and Core 2 iBGP between hubs and spoke I would like to understand how the traffic from the DC to the Spoke will prioritize the Hub 1 in this scenario. I learned from the article https://documentation.meraki.com/MX/Networks_and_Routing/BGP#Route_Advertisement_Behavior that routes learned from the Spoke by the Hub2 will have an additional ASN pre-pended but if I understand correctly it does not garantee that the traffic from the DC to the Spoke will prioritize the Hub 1: if the traffic arrives on Core 2 and there is not iBGP between Core 1 and Core 2, it will be sent to the Hub 2 and then to the Spoke (except that there is iBGP between hubs that I am not aware of). Could you please advise? Thanks a lot.
... View more
Jul 7 2021
12:42 AM
Hi @cmr , hi @KarstenI You are totally right, the WAN configuration is visible as soon as the ISP fixes their connectivity issue. I did not have physical access to the device so it took a while to have someone to test. Thanks for your great help.
... View more
Jul 4 2021
1:02 AM
Hi guys, I have a topology like this: MX-1 is the primary appliance, MX-1 is connected to both ISP1 and ISP2 routers MX-2 is the spare appliance, MX-2 is connected to both ISP1 and ISP2 routers The ports Internet 1 of MX-1 and MX-2 are already configured and are operational The ports Internet 2 of MX-1 and MX-2 are not configured yet (ISP2 did not provide the public IPs) Now I've just received the public IPs from the ISP2 and wanted to configure the ports Internet 2 of both MX. I configured them in: Appliance status > Uplink Spare status > Uplink I configured all IPs and saved the configuration but nothing displayed : When I clicked on the pencil icon, I could see all the parameters that I configured. I checked the ARP table but did not found any entries for Internet 2. I learned from https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair that "Dashboard configuration should always be performed before the Secondary MX is physically connected to the network." Does it explain the issue that I have? What should I do now to bring up the Internet 2 ports? Many thanks.
... View more
Jun 14 2021
8:53 AM
Hi @KarstenI Thanks for your advice. Just to be sure that I understand well, we will always receive our licenses in co-termination model, there is no way to convert it to per-device model BEFORE we claim the licences in the Dashboard? Is it correct? Thanks.
... View more
Jun 14 2021
7:48 AM
Hi UCcert, Thanks for your reply. For my understanding, do you know if there is a way to convert the license (from co-termination to per-device) before claiming the devices? Thanks.
... View more
Jun 14 2021
7:11 AM
Hi guys, I just claimed devices for a client a few days ago with the order number they provided (Organization > Configure > Inventory > Claim). The client is happy until they found out that the license started a month ago. I explained to them that licenses in the co-termination model start consuming time from the date purchased and not the date they are added to an Organization. The client is still unhappy because they will actually start installing the MXs gradually and don't want to waste months of their licenses. They wonder if per-device license can help in this case. I learned from the https://documentation.meraki.com/General_Administration/Licensing/Meraki_Per-Device_Licensing_Overview that the expiration date will not change when converting from co-termination to per-device model. Could you please advise? Thanks.
... View more
Jun 11 2021
3:12 AM
1 Kudo
Thanks all for your great help. It's nice to hear feedback from the field.
... View more
Jun 10 2021
3:07 PM
Hi, I have a pair of MX configured in HA routed mode. All 4 uplinks are configured with public IP addresses + 2 public VIP addresses as shown in the below diagram. I have a few questions: 1. Technically, is it possible to use private IP in this case? I have quite limited knowledge of ISP devices but I suppose that as my home Internet modem, they support DHCP and the MX could be configured with private IP? For example: MX-1 uplink 1: 192.168.1.1/24 MX-2 uplink 1: 192.168.1.2/24 VIP : 192.168.1.3/24 Default gateway = ISP1 device : 192.168.1.254/24 MX-1 uplink 2: 192.168.2.1/24 MX-2 uplink 2: 192.168.2.2/24 VIP : 192.168.2.3/24 Default gateway = ISP2 device : 192.168.2.254/24 2. If the answer is yes, why do we use public IP ? Is there something we can do with public IP but cannot with private IP? Thanks a lot for your help.
... View more
© 2024 Cisco Systems, Inc.
